Model-driven app / dataverse hash function to secure sensitive data in a column

[vonventti]

Not sure if I'm asking the correct thing, but we have a dataverse table in model driven app and one column has some sensitive data in it. I know that it is possible to hide this sensitive data from the user by using field level security, but the client would like to hide it using a hash function so that when the data is inputted it is secured with a hash function and then opened with a hash key. Is this possible to do in model driven app and dataverse?

Help is much appreciated, thank you!

[rampprakash]

Hi @vonventti 

After user inputted using plugin convert the values and store it.

Then create a button and pass the key then via action or plugin again decrypt and show the same.

For this we need customisation:-)

IM me if you need more help

[Fubar]

Also, if doing it with a plugin, the encryption step should be run pre-operation.

You may also need to consider, when it needs to be displayed unencrypted e.g. is it going to only be used in a power app (e.g. Model Driven App), will it be displayed encrypted in Lists etc if so you also have to build in Who can see it unencrypted (and when you start doing that, you are basically building Field Level Security)

[vonventti]

The thing is that the data is encrypted one way, which means that the social security number (which is the sensitive data in this case) should be encrypted once it is imported to the solution (using an excel). This social security number doesn't need to be access anymore once it has been encrypted, so the users shouldn't have to worry about opening the encryptions.

[Fubar · Accepted solution]

There is nothing out of the box for it, so you'll need to write plugin to encrypt it (and when you do it run the plugin pre-operation)

e.g.

a) Field for the user to data enter (or import into) to provide the unencrypted value

b) Field to hold the encrypted value

Write a Plugin and register steps to trigger it on Create and also on Change of the field in a)

• in the plugin code encrypt the value and save the encrypted value to b) AND
• in that same plugin step clear the value in a)
• register the Plugin steps as Pre-operation as this will allow you to clear a) without the raw value being saved.

Similar type of process if you need to compare later, get an unencrypted value, encrypt it and compare it to the stored encrypted value.

[dpoggemann]

Hi @vonventti ,

Please see the following strategy for the field level security from Microsoft.  https://learn.microsoft.com/en-us/purview/office-365-encryption-in-microsoft-dynamics-365 

Microsoft uses FIPS 140-2 for field level encryption and Transparent Data Encryption on the database at rest data.  

See details on FIPS 140-2 here:  https://csrc.nist.gov/pubs/fips/140-2/upd2/final 

Is this not enough for the business needs here?

[vonventti]

I'm not sure if we can do it using the field level security, since the customer claims that the data (a social security number in this case) has to be encrypted using hashbytes and the sha2_256 - algorithme, since they are using this method in their other applications which also use this sensitive data. From what I have understood this needs to be made in the SQL-server using a function which we have received from the customer. I've understood that the field level security is only masking the data instead of actually encrypting the data? But if dataverse supports this method, then of course it's enough. Since the customers input the data using excel files and then import it in dataverse, we have been thinking about encrypting the data already in excel, before the data is imported to dataverse, so that the inputted data would already be encrypted when it comes into dataverse, but I'm not really sure if it's going to work in this case.

[vonventti]

Ok, I haven't been written plugins before but I guess I have to give it a try. The value only needs to be encrypted once and the users do not need to see it after it is encrypted. Thank you for the answer, I'll keep you posted once I'm done to see how it went.

[vonventti]

I seem to have got it working, thank you! Needed to look into plugin development and thanks also to @rampprakash youtube tutorial ("How to write PreOperation Plugin"), it was really helpful! 🙂